
Malicious AGENTS.md file in a Downloads folder tricks an AI coding agent into installing a rogue npm package
Forever Security found the file on a customer's computer, reproduced the attack against OpenAI Codex, and showed a related technique that leaks Claude Code OAuth tokens.






